mcp-claimcheck

Status: pre-alpha, under construction. Phases 1 to 3 of 15 are done:

• a transparent passthrough proxy (mcp-claimcheck run -- <server command>) that forwards MCP traffic unchanged;
• which reads each tool result and logs what it saw (--log-level info);
• and contracts, which can now be written and validated (mcp-claimcheck check). The format is described in docs/CONTRACTS.md in the source repository, which is not public yet.

Nothing is verified against a contract yet: contracts are read and checked for being well formed, and no tool call is judged against one. The rest of this README describes the goal, not current behaviour.

Your agent called the tool. The tool returned success. Did the operation actually succeed?

mcp-claimcheck is a runtime semantic verification layer for MCP tool calls. It will sit between an MCP client and an upstream MCP server, check each tools/call result against declared contracts and built-in heuristics, and report when a result does not satisfy the operation it claims to have completed.

What it will not do

• It cannot block execution. It inspects responses, so by the time it sees a result the upstream tool has already run. What it can do is stop the agent from reporting a success that did not happen.
• It cannot see inside MCP servers. It only sees MCP JSON-RPC traffic. If a server hides a backend failure and returns an empty result, that empty result is reported as unverifiable, not as a failure.

License

MIT. The full text ships with the package as LICENSE.